DPDP compliance,
built into your systems.
The DPDP Act reaches almost every business that holds a customer's name, phone number, email, or KYC document. Size is not the exemption people hope it is.
A privacy policy is not compliance. The work sits in your forms, CRM, consent records, retention jobs, vendor contracts, and the way your team handles data every day. We build that operating layer, then leave you with evidence you can show a customer, auditor, or investor.
What you get
- ✓A data map that shows where personal data actually lives
- ✓Consent that is purpose-wise, recorded, and revocable
- ✓A rights and breach process your team can run without us
Fixed scope before work begins. Senior delivery, not a handoff.
Quick answer
DPDP consulting is the operational work of meeting India's Digital Personal Data Protection Act: mapping personal data, fixing notice and consent, handling data-principal requests, setting retention and deletion, preparing breach response, and training staff. Spurto delivers these as working controls, not a policy document. Engagements typically run 6–12 weeks.
Where DPDP exposure usually sits
A privacy policy exists, but consent is not recorded anywhere.
No one can list which systems hold customer or employee data.
Customer data sits in WhatsApp, personal email, and spreadsheets.
A data-principal request would be handled by improvisation.
Vendors process personal data without data-protection clauses.
Staff paste customer details into public AI tools.
From gap assessment to working controls
DPDP gap assessment
A risk-rated gap register across notice, consent, purpose, retention, rights, security, vendors, and breach response.
Data and PII inventory
Where personal data enters, where it lives, who can access it, and which vendors receive it.
Consent and notice architecture
Purpose-wise consent journeys for website, app, onboarding, KYC, marketing, and cookies, with records and withdrawal.
Data-principal rights workflow
Intake, identity verification, fulfilment, timelines, and an audit trail for access, correction, erasure, grievance, and nomination.
Retention and deletion
Retention periods by data category, deletion jobs, legal holds, and a clear position on backups and archives.
Breach response and vendor controls
A runnable first-24-hours playbook, notification decision tree, processor inventory, due-diligence questionnaires, and contract clauses.
How a 90-day implementation runs
Assess
Interviews, system review, and data-flow mapping across sales, operations, HR, finance, and support. Output: a risk-rated gap register.
Design
The consent model, notice drafts, rights workflow, retention schedule, and vendor clause set. Output: a design pack your team can approve.
Implement
Consent UI and records, rights intake, deletion jobs, access controls, and vendor paperwork. Output: controls that run in the systems you already use.
Test
We simulate a rights request and a breach, test consent withdrawal and deletion, and fix what fails. Output: a test report, not a claim.
Operate
Role-based SOPs, staff training, an audit log, and a quarterly review rhythm. Output: compliance that survives staff turnover.
What you walk away with
| Deliverable | Format | Decision it enables |
|---|---|---|
| DPDP gap register | Risk-rated spreadsheet | What to fix first |
| Data and PII map | Flow map + register | Where data lives and who owns it |
| Consent and notice pack | Journey maps, UI requirements, notice drafts | How consent is captured and withdrawn |
| Rights workflow | Process + system requirements | How requests are fulfilled on time |
| Retention schedule | Data-category matrix | What to keep, delete, and hold |
| Breach playbook | Runnable procedure + templates | What to do in the first 24 hours |
Who this is for
SMEs collecting customer data through websites, apps, WhatsApp, or offline forms
NBFCs, HFCs, and fintechs handling KYC and financial data
Healthcare, education, and e-commerce businesses with sensitive data
Companies putting customer or employee data into AI tools
Businesses facing procurement, funding, or acquisition due diligence
Organisations that need a data protection owner without a full-time hire
Not for
- —A legal opinion only. Engage counsel; we implement alongside them.
- —A policy document with no change to forms, systems, or staff behaviour.
- —A business that holds no digital personal data. That is rare, but we will say so.
Things buyers usually ask
Does DPDP apply to my business?
If you process digital personal data - names, phone numbers, emails, KYC documents, employee records - the Act likely applies. Size is not a blanket exemption. Some obligations scale with sensitivity and scale, but notice, consent, purpose limitation, security, and rights handling apply broadly.
What is the difference between a privacy policy and consent?
A privacy policy explains how data is handled. Consent is an affirmative, specific permission from the individual for a defined purpose. DPDP requires a clear notice and a lawful basis for processing. A policy page on its own does not record consent, prove it, or let someone withdraw it.
What is the DPDP compliance deadline?
The Rules set a phased timetable, with most operational obligations landing by 2027. The practical deadline is often earlier: a customer contract, investor diligence, or enterprise procurement will ask for evidence before the regulator does. We map your obligations to the dates that apply to you.
Do we need a Data Protection Officer?
A DPO is mandatory for Significant Data Fiduciaries and may be required in other cases. Even where it is not mandatory, someone must own the obligations. We can design an outsourced DPO function or help you appoint and brief an internal owner.
Can you build consent into our website and CRM?
Yes. We implement consent banners, purpose-wise opt-ins, consent records, withdrawal, and rights intake, then integrate them with your CRM, marketing tools, or data platform. The aim is a record you can produce, not a banner that merely looks compliant. It should work without a rebuild of your site.
Do you provide legal advice?
No. We provide operational and technical implementation. Where legal interpretation is needed, we work with your counsel or introduce a qualified lawyer. Our job is to turn the legal position into forms, systems, retention rules, and staff behaviour that hold up in practice. That division keeps the advice honest.
How does DPDP affect our use of AI tools?
AI tools often process personal data, so the same rules apply: lawful basis, purpose limitation, minimisation, retention, and security. We map what is sent to which model, add redaction and retention controls, and define where a human must review the output.
How long does implementation take?
A gap assessment takes two to three weeks. Full implementation across systems and touchpoints usually runs 6–12 weeks, depending on complexity. Compliance then becomes a quarterly operating rhythm: training, review, audit log, and a tested breach process. We confirm the scope in week one.
Tell us what you are trying to fix.
We will tell you if we can help.
A 30-minute review with the person who would run the work. No pitch deck, no commitment.